Path Traversal in Apache MINA SSHD SCP File Reception
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 20, 2026
Apache disclosed CVE-2026-56452, a moderate-severity path traversal flaw in the sshd-scp component of Apache MINA SSHD that lets a malicious SCP sender write files to attacker-controlled locations during file reception. The issue stems from improper validation of filenames supplied in SCP C or D commands, creating a risk for applications that use Apache MINA SSHD to receive files over SCP.
The vulnerability affects org.apache.sshd:sshd-scp through 2.18.0 and 3.0.0-M1 through 3.0.0-M4. Apache said applications using Apache MINA SSHD 2.0.0 or later are impacted only if they rely on sshd-scp for inbound file transfers, and it released fixes in 2.19.0 and 3.0.0-M5. The flaw was reported by Unbbal.
